[....] Starting enhanced syslogd: rsyslogd[ 15.475814] audit: type=1400 audit(1519121157.456:5): avc: denied { syslog } for pid=3973 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.687732] audit: type=1400 audit(1519121160.668:6): avc: denied { map } for pid=4111 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.215' (ECDSA) to the list of known hosts. [ 24.992477] audit: type=1400 audit(1519121166.973:7): avc: denied { map } for pid=4125 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 10:06:07 parsed 1 programs 2018/02/20 10:06:07 executed programs: 0 [ 25.262120] audit: type=1400 audit(1519121167.242:8): avc: denied { map } for pid=4125 comm="syz-execprog" path="/root/syzkaller-shm266815199" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 25.275386] IPVS: ftp: loaded support on port[0] = 21 [ 25.495521] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 26.296272] [ 26.297909] ===================================== [ 26.302728] WARNING: bad unlock balance detected! [ 26.307535] 4.16.0-rc2+ #320 Not tainted [ 26.311561] ------------------------------------- [ 26.316376] syz-executor0/4289 is trying to release lock (rcu_read_lock_bh) at: [ 26.323799] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.330775] but there are no more locks to release! [ 26.335764] [ 26.335764] other info that might help us debug this: [ 26.342405] 4 locks held by syz-executor0/4289: [ 26.347038] #0: (&(ptlock_ptr(page))->rlock#2){+.+.}, at: [<0000000013b5dcb4>] unmap_page_range+0xc5d/0x22e0 [ 26.357164] #1: ((&idev->mc_ifc_timer)){+.-.}, at: [<00000000fd9792c4>] call_timer_fn+0x1c6/0x820 [ 26.366342] #2: (rcu_read_lock){....}, at: [<00000000888cc0b1>] mld_sendpack+0x180/0xe70 [ 26.374721] #3: (rcu_read_lock){....}, at: [<0000000004cf20a8>] nf_hook.constprop.37+0x0/0x830 [ 26.383620] [ 26.383620] stack backtrace: [ 26.388093] CPU: 1 PID: 4289 Comm: syz-executor0 Not tainted 4.16.0-rc2+ #320 [ 26.395331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.404658] Call Trace: [ 26.407214] [ 26.409341] dump_stack+0x194/0x257 [ 26.412938] ? arch_local_irq_restore+0x53/0x53 [ 26.417577] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.422996] print_unlock_imbalance_bug+0x12f/0x140 [ 26.427989] lock_release+0x6fe/0xa40 [ 26.431761] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.437268] ? lock_downgrade+0x980/0x980 [ 26.441383] ? lock_release+0xa40/0xa40 [ 26.445324] ? __raw_spin_lock_init+0x1c/0x100 [ 26.449873] ? do_raw_spin_trylock+0x190/0x190 [ 26.454425] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 26.459681] ? lock_downgrade+0x980/0x980 [ 26.463804] ? dsthash_find+0x5b0/0x5b0 [ 26.467749] ? __lock_acquire+0x664/0x3e00 [ 26.471951] ? is_bpf_text_address+0x7b/0x120 [ 26.476414] ? lock_downgrade+0x95a/0x980 [ 26.480531] ? rcutorture_record_progress+0x10/0x10 [ 26.485517] ? __kernel_text_address+0xd/0x40 [ 26.489984] ? unwind_get_return_address+0x61/0xa0 [ 26.494885] hashlimit_mt+0x78/0x90 [ 26.498569] ? hashlimit_mt+0x78/0x90 [ 26.502339] ip6t_do_table+0x98d/0x1a30 [ 26.506287] ? kmem_cache_alloc_trace+0x136/0x740 [ 26.511101] ? mld_sendpack+0x617/0xe70 [ 26.515045] ? ip6t_error+0x60/0x60 [ 26.518643] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 26.523981] ? check_noncircular+0x20/0x20 [ 26.528186] ? lock_acquire+0x1d5/0x580 [ 26.532130] ? lock_acquire+0x1d5/0x580 [ 26.536076] ? igmp6_mcf_seq_next+0x660/0x660 [ 26.540539] ? lock_release+0xa40/0xa40 [ 26.544483] ip6table_raw_hook+0x65/0x80 [ 26.548515] nf_hook_slow+0xba/0x1a0 [ 26.552201] nf_hook.constprop.37+0x3f6/0x830 [ 26.556671] ? igmp6_mcf_seq_next+0x660/0x660 [ 26.561135] ? trace_hardirqs_on+0xd/0x10 [ 26.565252] ? __local_bh_enable_ip+0x121/0x230 [ 26.569889] ? _raw_spin_unlock_bh+0x30/0x40 [ 26.574267] ? rt6_uncached_list_add+0x1b7/0x240 [ 26.578992] ? rt6_fill_node+0x18b0/0x18b0 [ 26.583200] ? icmp6_dst_alloc+0x475/0x660 [ 26.587406] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 26.591696] ? icmpv6_flow_init+0x1f6/0x270 [ 26.596002] mld_sendpack+0x6c2/0xe70 [ 26.599788] ? nf_hook.constprop.37+0x830/0x830 [ 26.604428] ? mark_held_locks+0xaf/0x100 [ 26.608546] ? trace_hardirqs_on+0xd/0x10 [ 26.612664] ? __local_bh_enable_ip+0x121/0x230 [ 26.617301] mld_ifc_timer_expire+0x3d9/0x770 [ 26.621767] call_timer_fn+0x228/0x820 [ 26.625623] ? mld_dad_timer_expire+0x100/0x100 [ 26.630259] ? process_timeout+0x40/0x40 [ 26.634288] ? __run_timers+0x7e3/0xb70 [ 26.638233] ? lock_downgrade+0x980/0x980 [ 26.642352] ? debug_object_deactivate+0x364/0x560 [ 26.647252] ? lock_release+0xa40/0xa40 [ 26.651195] ? mark_held_locks+0xaf/0x100 [ 26.655312] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 26.660295] ? mld_dad_timer_expire+0x100/0x100 [ 26.664930] ? mld_dad_timer_expire+0x100/0x100 [ 26.669566] __run_timers+0x7ee/0xb70 [ 26.673340] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 26.678584] ? timerqueue_add+0x1e9/0x280 [ 26.682701] ? check_noncircular+0x20/0x20 [ 26.686902] ? enqueue_hrtimer+0x177/0x4b0 [ 26.691108] ? lock_release+0xa40/0xa40 [ 26.695053] ? retrigger_next_event+0x1e0/0x1e0 [ 26.699690] ? print_irqtrace_events+0x270/0x270 [ 26.704413] ? check_noncircular+0x20/0x20 [ 26.708618] ? clockevents_program_event+0x163/0x2e0 [ 26.713689] ? lock_downgrade+0x980/0x980 [ 26.717808] ? __lock_is_held+0xb6/0x140 [ 26.721841] run_timer_softirq+0x4c/0x70 [ 26.725874] __do_softirq+0x2d7/0xb85 [ 26.729661] ? ktime_get+0x26f/0x3a0 [ 26.733344] ? __irqentry_text_end+0x1f8ad4/0x1f8ad4 [ 26.738425] ? check_noncircular+0x20/0x20 [ 26.742628] ? native_apic_msr_write+0x5c/0x80 [ 26.747182] ? lapic_next_event+0x54/0x80 [ 26.751299] ? clockevents_program_event+0x108/0x2e0 [ 26.756371] ? tick_program_event+0x83/0x100 [ 26.760749] ? __lock_is_held+0xb6/0x140 [ 26.764784] irq_exit+0x1cc/0x200 [ 26.768207] smp_apic_timer_interrupt+0x16b/0x700 [ 26.773020] ? smp_reschedule_interrupt+0xe6/0x650 [ 26.777925] ? smp_call_function_single_interrupt+0x640/0x640 [ 26.783781] ? _raw_spin_lock+0x32/0x40 [ 26.787725] ? _raw_spin_unlock+0x22/0x30 [ 26.791844] ? handle_edge_irq+0x2b4/0x7c0 [ 26.796052] ? task_prio+0x50/0x50 [ 26.799563] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.804375] apic_timer_interrupt+0x8e/0xa0 [ 26.808663] [ 26.810870] RIP: 0010:lock_release+0x503/0xa40 [ 26.815415] RSP: 0018:ffff8801b6d26d38 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12 [ 26.823090] RAX: dffffc0000000000 RBX: ffff8801b6dd22c0 RCX: 1ffff10036dba565 [ 26.830328] RDX: 1ffffffff0d592d5 RSI: 0000000000000002 RDI: 0000000000000282 [ 26.837564] RBP: ffff8801b6d26e68 R08: 0000000000000000 R09: 1ffff10036da4db0 [ 26.844807] R10: ffff8801b6d26cb8 R11: 0000000000000001 R12: bbe3337e572a9dab [ 26.852060] R13: ffff8801b6dd22c0 R14: ffff8801b6d26d80 R15: 1ffff10036da4dac [ 26.859331] ? __unlock_page_memcg+0x53/0x100 [ 26.863811] ? lock_downgrade+0x980/0x980 [ 26.867947] ? PageHuge+0x15c/0x270 [ 26.871560] ? prep_compound_gigantic_page+0x440/0x440 [ 26.876826] ? __lock_is_held+0xb6/0x140 [ 26.880865] ? __mem_cgroup_largest_soft_limit_node+0x780/0x780 [ 26.886895] __unlock_page_memcg+0x72/0x100 [ 26.891187] unlock_page_memcg+0x2c/0x40 [ 26.895220] page_remove_rmap+0x3b7/0xeb0 [ 26.899335] ? page_add_file_rmap+0xc50/0xc50 [ 26.903802] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 26.908877] ? find_held_lock+0x35/0x1d0 [ 26.912909] ? lock_acquire+0x1d5/0x580 [ 26.916856] ? lock_acquire+0x1d5/0x580 [ 26.920800] ? unmap_page_range+0xc5d/0x22e0 [ 26.925178] ? lock_downgrade+0x980/0x980 [ 26.929296] ? lock_release+0xa40/0xa40 [ 26.933240] ? rcu_note_context_switch+0x710/0x710 [ 26.938136] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 26.943991] ? _vm_normal_page+0xd5/0x200 [ 26.948110] unmap_page_range+0xfc3/0x22e0 [ 26.952316] ? vm_normal_page_pmd+0x2c0/0x2c0 [ 26.956779] ? __free_insn_slot+0x5c0/0x5c0 [ 26.961071] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 26.966232] ? rcutorture_record_progress+0x10/0x10 [ 26.971217] ? is_bpf_text_address+0xa4/0x120 [ 26.975679] ? kernel_text_address+0x102/0x140 [ 26.980229] ? __kernel_text_address+0xd/0x40 [ 26.984692] ? unwind_get_return_address+0x61/0xa0 [ 26.989589] ? __save_stack_trace+0x7e/0xd0 [ 26.993882] ? save_stack+0x43/0xd0 [ 26.997476] ? __kasan_slab_free+0x11a/0x170 [ 27.001850] ? kasan_slab_free+0xe/0x10 [ 27.005798] ? kmem_cache_free+0x83/0x2a0 [ 27.009916] ? mmput+0x54a/0x6c0 [ 27.013251] ? do_exit+0x90a/0x1ad0 [ 27.016853] ? do_group_exit+0x149/0x400 [ 27.020880] ? SyS_exit_group+0x1d/0x20 [ 27.024824] ? do_syscall_64+0x280/0x940 [ 27.028852] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 27.034186] ? debug_check_no_obj_freed+0x3da/0xf1f [ 27.039173] ? uprobe_munmap+0x127/0x430 [ 27.043209] ? uprobe_mmap+0xc90/0xc90 [ 27.047066] ? __khugepaged_exit+0x3f7/0x640 [ 27.051449] unmap_single_vma+0x15f/0x2d0 [ 27.055567] unmap_vmas+0xf1/0x1b0 [ 27.059080] exit_mmap+0x23a/0x500 [ 27.062590] ? SyS_munmap+0x30/0x30 [ 27.066186] ? __khugepaged_exit+0x42f/0x640 [ 27.070569] ? __might_sleep+0x95/0x190 [ 27.074522] mmput+0x223/0x6c0 [ 27.077684] ? get_task_exe_file+0xc0/0xc0 [ 27.081888] ? is_current_pgrp_orphaned+0xa0/0xa0 [ 27.086699] ? do_exit+0x8fa/0x1ad0 [ 27.090300] ? lock_downgrade+0x980/0x980 [ 27.094419] ? mark_held_locks+0xaf/0x100 [ 27.098535] ? do_raw_spin_trylock+0x190/0x190 [ 27.103085] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.108070] ? trace_hardirqs_on+0xd/0x10 [ 27.112188] do_exit+0x90a/0x1ad0 [ 27.115613] ? __check_object_size+0x8b/0x530 [ 27.120092] ? mm_update_next_owner+0x930/0x930 [ 27.124727] ? __might_sleep+0x95/0x190 [ 27.128672] ? kasan_check_write+0x14/0x20 [ 27.132876] ? _copy_from_user+0x99/0x110 [ 27.136991] ? rw_copy_check_uvector+0x1be/0x280 [ 27.141719] ? rcu_pm_notify+0xc0/0xc0 [ 27.145577] ? vfs_writev+0x210/0x340 [ 27.149349] ? kfree+0x1f6/0x260 [ 27.152684] ? vfs_writev+0x215/0x340 [ 27.156459] ? __fdget_pos+0x130/0x190 [ 27.160317] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 27.164866] ? __fdget_raw+0x20/0x20 [ 27.168551] ? SyS_futex+0x269/0x390 [ 27.172237] do_group_exit+0x149/0x400 [ 27.176092] ? do_futex+0x22a0/0x22a0 [ 27.179863] ? SyS_exit+0x30/0x30 [ 27.183286] ? move_addr_to_kernel+0x60/0x60 [ 27.187666] ? do_syscall_64+0xb6/0x940 [ 27.191610] ? do_group_exit+0x400/0x400 [ 27.195639] SyS_exit_group+0x1d/0x20 [ 27.199406] do_syscall_64+0x280/0x940 [ 27.203260] ? __do_page_fault+0xc90/0xc90 [ 27.207462] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 27.212186] ? syscall_return_slowpath+0x550/0x550 [ 27.217083] ? syscall_return_slowpath+0x2ac/0x550 [ 27.221983] ? prepare_exit_to_usermode+0x350/0x350 [ 27.226973] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 27.232306] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.237115] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 27.242273] RIP: 0033:0x453da9 [ 27.245434] RSP: 002b:00007ffc094184c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 27.253112] RAX: ffffffffffffffda RBX: 000000000000001b RCX: 0000000000453da9 [ 27.260351] RDX: 0000000000000610 RSI: 0000000000735588 RDI: 0000000000000000 [ 27.267588] RBP: 00007ffc09418ba0 R08: 0000000000000000 R09: 0000000000000003 [ 27.274829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.282067] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000001380 2018/02/20 10:06:12 executed programs: 441 2018/02/20 10:06:17 executed programs: 1128